CVE-2023-34195: Code Injection
First published: Mon Sep 18 2023(Updated: )
An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses this value as a function pointer. This variable is wiped out by the same module near the end of the function. By setting this UEFI variable from the OS to point into custom code, an attacker could achieve arbitrary code execution in the DXE phase, before several chipset locks are set.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Insyde InsydeH2O | >=5.2<5.2.05.28.22 | |
| Insyde InsydeH2O | >=5.3<5.3.05.37.22 | |
| Insyde InsydeH2O | >=5.4<5.4.05.45.22 | |
| Insyde InsydeH2O | >=5.5<5.5.05.53.22 | |
| Insyde InsydeH2O | >=5.6<5.6.05.60.22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-34195?
CVE-2023-34195 is an issue in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5, where a runtime variable is wiped out, leading to a potential function pointer misuse.
What is the severity of CVE-2023-34195?
CVE-2023-34195 has a severity rating of 7.8 out of 10, indicating a high-level vulnerability.
How does CVE-2023-34195 affect Insyde InsydeH2O?
CVE-2023-34195 affects Insyde InsydeH2O versions 5.0 through 5.5, potentially allowing for the misuse of function pointers.
How can I fix CVE-2023-34195?
To fix CVE-2023-34195, it is recommended to update to a patched version of Insyde InsydeH2O. Refer to the vendor's security advisory for more information.
Where can I find more information about CVE-2023-34195?
You can find more information about CVE-2023-34195 in the vendor's security advisory at https://www.insyde.com/security-pledge/SA-2023052
- collector/nvd-index
- agent/author
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/weakness
- agent/tags
- vendor/insyde
- canonical/insyde insydeh2o
- version/insyde insydeh2o/5.2
- version/insyde insydeh2o/5.3
- version/insyde insydeh2o/5.4
- version/insyde insydeh2o/5.5
- version/insyde insydeh2o/5.6